EN 
UA 
RU 
10.08.2022
IIT DISTRIBUTION IS THE OFFICIAL DISTRIBUTOR OF WALLIX IN UKRAINE
01.08.2022
Tales from the Dark Web: How Tracking eCrime’s Underground Economy Improves Defenses
20.07.2022
The Rise of Botnet and DDoS Attacks
11.07.2022
Detecting and Mitigating NTLM Relay Attacks Targeting Microsoft Domain Controllers
17.06.2022
What is Data Democratization?
03.06.2022
Immutable Backups Explained: All You Need to Know to Secure Your Data
19.05.2022
Compromised Docker Honeypots Used for Pro-Ukrainian DoS Attack
06.05.2022
WHAT'S NEW IN LABYRINTH DECEPTION PLATFORM: RELEASE 2.0.32
22.04.2022
Palo Alto Networks проінформувала про вразливості, які можуть дозволити зловмиснику відключити платформу Cortex XDR
20.04.2022
Advanced anti-DDoS solutions from A10 Networks are available for installation!
15.04.2022
Inspur Information Rated Gartner Hype Cycle Sample Vendor of Cloud-Optimized Hardware for Second Year
07.04.2022
FAST DELIVERY OF INFINIDAT AND INSPUR SOLUTIONS AVAILABLE NOW!
04.04.2022
Decryptable PartyTicket Ransomware Reportedly Targeting Ukrainian Entities
26.03.2022
HOW NOT TO BECOME AN "UNWITTING ACCOMPLICE" OF RUSSIAN CYBER ATTACKS ON UKRAINIAN SYSTEMS (PART 3)
22.03.2022
CrowdStrike Falcon protects against new Wiper malware used in cyberattacks against Ukraine
20.03.2022
HOW TO NOT BECOME AN "UNCONSCIOUS ACCOMPLICE" TO RUSSIAN CYBER ATTACKS ON UKRAINIAN SYSTEMS (PART 2)
16.03.2022
A10 NETWORKS SECURITY RESEARCH: HOW NOT TO BECOME AN "UNCONSCIOUS ACCOMPLICE" TO RUSSIAN CYBERATTACKS ON UKRAINIAN SYSTEMS
23.02.2022
Демонстрація: CrowdStrike Falcon детектує набір вірусів WhisperGate
23.02.2022
Inspur — компанія №1 за часткою світового ринку AI-серверів!
18.02.2022
Відтепер компанія iIT Distribution – офіційний дистриб’ютор рішень Picus Security!
17.02.2022
Звіт про глобальні загрози 2022 року від CrowdStrike!
14.02.2022
iIT Distribution підписала партнерську угоду з компанією Inspur!
10.02.2022
Пост-реліз: Вебінар, присвячений оновленим можливостям Nakivo Backup & Replication v10.5
10.02.2022
Новітня розробка Falcon XDR від компанії CrowdStrike тепер доступна для користувачів!
02.02.2022
Знайомство з процесами Security Operations Center (SOC) та найкращі рекомендації для його ефективної роботи від Lepide
27.01.2022
Кібератака на українські державні сайти: що нам відомо сьогодні
21.01.2022
Технічний аналіз шкідливого завантажувача WhisperGate, націленого на українські організації
14.01.2022
CrowdStrike Services випускає Incident Response Tracker для спеціалістів DFIR (Digital Forensics and Incident Response)
12.01.2022
Експлойт noPac: Нова вразливість Microsoft AD може призвести до повної компрометації домену за лічені секунди
06.01.2022
7 IT-тенденцій 2022 року, які слід взяти на озброєння
30.12.2021
Витік секретних IP-адрес Pfizer не є рідкістю. Захистіть свої хмарні дані за допомогою проактивного шифрування
30.12.2021
6 афер, які слід уникати в ці новорічні свята: добірка рекомендацій від Panda Security
17.12.2021
Як CrowdStrike захищає клієнтів від загроз, пов'язаних з Log4Shell
16.12.2021
Що таке SCAR і якими технологіями керуються мисливці на загрози з команди Falcon OverWatch?
09.12.2021
Acra Community Edition 0.90.0: шифрування в SQL та NoSQL базах даних без додаткового програмування
08.12.2021
11 кроків до відновлення після фішингової атаки: рекомендації від Lepide
30.11.2021
Компанія Aruba (HPE) шістнадцятий рік поспіль визнається лідером у звіті Gartner Magic Quadrant for Enterprise Wired and WLAN Infrastructure 2021!
23.11.2021
Серія вебінарів від iIT Distribution & NAKIVO: твій надійний бекап!
21.11.2021
Рішення CrowdStrike Falcon отримало найвищу оцінку AAA за результатами тестування організації SE Labs
15.11.2021
Бізнес-вечеря CrowdStrike: як це було?
08.11.2021
iIT Distribution – офіційний дистриб'ютор компанії Nakivo!
05.11.2021
Компанію CrowdStrike визнали світовим лідером у галузі сучасного захисту кінцевих точок в останньому звіті IDC MarketScape!
03.11.2021
What is it the information security of the enterprise? What are the basic principles of data protection?
02.11.2021
CrowdStrike and AWS Expand Integrations to Provide Customers Multi-layered Protection Against Ransomware Attacks and Sophisticated Threats
29.10.2021
Global Threat Report 2021 від CrowdStrike вже доступний українською мовою!
25.10.2021
SDP чи VPN? (Чи обидва варіанти?)
19.10.2021
CrowdStrike представляє перший у своєму роді XDR Module, що забезпечує виявлення інцидентів у реальному часі й автоматичне реагування по всьому стеку безпеки
19.10.2021
Infinidat – лідер серед первинних систем зберігання даних згідно зі звітом Gartner Magic Quadrant 2021
18.10.2021
Компанія iIT Distribution отримала статус офіційного дистриб'ютора A10 Networks
11.10.2021
Впровадження інновації no-code в мережеві процеси
11.10.2021
iIT Distribution розширив арсенал своїх здобутків: фаховий сертифікат NetBrain Certified Platform Associate
05.10.2021
SuperMem: Безкоштовний інструмент CrowdStrike Incident Response для автоматизації обробки образів пам'яті
30.09.2021
Захід, що розширює кордони знань і можливостей: Перший Щорічний Форум з Кібербезпеки CS² DAY 2021 справив справжній фурор на гостей!
23.09.2021
На завершення знайомства з партнерами заходу CS² DAY представляємо компанію-системного інтегратора – CS Consulting!
21.09.2021
Провідний фахівець Security-підрозділу компанії IBM Віталій Воропай завітає на CS² DAY в якості спікера!
20.09.2021
Список спікерів Першого Щорічного Форуму з Кібербезпеки лише поповнюється: знайомтеся з Дмитром Петращуком від компанії IT-Specialist
20.09.2021
На CS² DAY виступлять представники державного сектору: Віктор Жора та Олександр Галущенко!
17.09.2021
Зустрічайте наступного запрошеного спікера довгоочікуваного CS² DAY – Олексія Зайончковського від компанії Netwave!
16.09.2021
Представляємо другого спікера CS² DAY: Михайло Кропива – InfoSec Director топової української IT-компанії SoftServe!
16.09.2021
Познайомтеся ближче з компанією-головним партнером CS² DAY та першим спікером заходу – Майклом Чальватцісом!
08.09.2021
iIT Distribution та CrowdStrike запрошують на CS² DAY – Перший Щорічний Форум з Кібербезпеки!
03.09.2021
Компанія iITD зібрала своїх партнерів на бізнес-вечері A10 Vendor`s Day
30.08.2021
Модель Zero Trust і система DLP: що нового розповіли наші представники та партнери на міжнародній конференції «Digital Change & Customers — Цифрові зміни та клієнтський сервіс»
05.08.2021
We invite you to the international conference "Digital Change & Customers”
28.07.2021
IT'S TIME TO STOP THE FEAR OF NEW TECHNOLOGIES: HOW CAN YOU CHANGE YOUR USUAL SOLUTION PROVIDERS AND IMPLEMENT MORE ADVANCED TECHNOLOGIES INTO YOUR INFRASTRUCTURE?
20.07.2021
Achieve petabyte-scale data protection with lightning-fast recovery!
12.07.2021
Infinidat — is the best choice for Gartner Peer Insights 2021 customers!
06.07.2021
CrowdStrike took first place in the market share of Modern Endpoint Security 2020!
05.07.2021
A10 Thunder ADC application delivery controller in our warehouse!
22.06.2021
The announcement of a new solution for storing InfiniBox SSA corporate class data from infinidat!
10.06.2021
The invitation to the third virtual forum CrowdStrike!
07.06.2021
The first deliveries of Aruba network equipment
01.06.2021
GTB Technologies comprehensive DLP solution received a certificate from the State Service for Special Communications and Information Protection of Ukraine
31.05.2021
How subtle attacks maximize hackers' profits and what defensive actions need to be taken immediately
19.05.2021
iIT Distribution is the official distributor of Automox
18.05.2021
A series of training workshops from CrowdStrike
11.05.2021
CrowdStrike has become the leader in the Gartner Magic Quadrant 2021 for the second time among endpoint protection platforms!
11.05.2021
Review of the new version of NetBrain Integrated Edition 10.0. Continuation
28.04.2021
Review of the new version of NetBrain Integrated Edition 10.0
26.04.2021
Infinidat is launching a partner accreditation program
16.04.2021
iIT Distribution is the official distributor of Lookout
12.04.2021
iIT Distribution expands its portfolio with networking solutions from Aruba Networks
12.04.2021
IIT Distribution received the status of a Business Partner in the Hewlett Packard Enterprise affiliate program
08.04.2021
Why should hosting providers pay attention to Infinidat data storage solution? Practical experience of use
05.04.2021
The ZTNA model helps reduce the stress loading of employees from remote work
30.03.2021
Сrowdstrike named leader in security Threat Detection, Response and Investigation of cyberincidents (MDMR)!
24.03.2021
Falcon X від CrowdStrike визнаний лідер у звіті Forrester Wave: External Threat Intelligence Services за перший квартал 2021 року!
15.03.2021
New Forrester study shows all the economic benefits of using the Falcon Complete!
02.03.2021
iITD is the official partner of the International Grand Forum "BIT & BIS-2021"!
24.02.2021
CrowdStrike has announced the acquisition of Humio's leading high-performance log management platform!
18.02.2021
Intelligent IT Distribution at the international conference "Go Digital - 2021: acceleration and migration. Money goes online".
08.02.2021
International Conference "Go Digital - 2021: acceleration and migration. Money goes online".
25.01.2021
Crowdstrike's response to recent supply chain attacks
08.10.2020
Intelligent IT Distribution takes part in the third annual international forum "Cybersecurity - protect business, protect the state"
29.09.2020
IITD - partner of the forum "Cybersecurity - protect business, protect the country" 2020
24.09.2020
iIT Distribution got the status of a distributor of Netbrain technologies solutions in the territory of Ukraine
28.08.2020
Fal.Con 2020 by CrowdStrike
25.08.2020
Compliance with cyberrisk insurance
25.08.2020
Automatically block compartment accounts with Lepide Active Directory Self Service 20.1
25.08.2020
Cossack Labs invites you to visit NONAMECON
22.07.2020
Signing a distribution agreement with SAFE-T
21.07.2020
International Conference "Online Banking - Time of Innovation!"
18.06.2020
Global Cyber Threat Report 2020
11.06.2020
Thursday, the 25-th of June, 2020. Do not miss!
20.05.2020
PandaLabs Report: Understanding Threats 2020
05.05.2020
Announcement: New version of ACRA Enterprise, which provides increased flexibility for high-loaded systems
13.04.2020
Lepide Remote Worker Monitoring Pack is a simple in deployment and lightweight security platform, which offers immediate protection of business data during an unforeseen period of remote work.
12.04.2020
Ensuring cybersecurity for remote users
08.04.2020
Labyrinth Technologies offers to take advantage of a special offer - a license for 12 months at a price of 6 months
07.04.2020
Crowdstrike: Remote work and IT security during the crisis - a reduced licensed program for 3-6 months
23.03.2020
IIT Distribution received the status of distributor solutions RedSeal Networks in Ukraine
23.03.2020
IIT DISTRIBUTION has received the status of a Lepide solutions distributor in Ukraine
Distributed Denial of Service (DDoS) attacks have become an everyday or, some might argue, an hourly problem. Using a variety of techniques, a wide range of threat actors from lone hackers, criminal gangs and hacktivists, to nation-states have and are using DDoS attacks.
These attacks are carried out in order to reduce the performance and disable the network communication of the systems. These targets can be small or large businesses, Internet service providers, manufacturers, retailers, healthcare providers, schools and universities, or other organizations. State institutions, law enforcement structures, defense sector organizations are a special target for criminals. Essentially, any organization with an Internet presence can become a DDoS target.
Now, here is the why. There are three main reasons why people create botnets: For financial gain by extortion—pay up or we keep attacking; to make a point—stop (or start) doing something or we continue; or, in the case of nation-state actors, as an espionage or cyber warfare tactic.
From this article, you will learn how botnets and DDoSattacks are created - how botnet attacks and DDoS attacks are created - the most common mechanism of attacks using a collection of remotely controlled, hacked services or devices.
What is a botnet?
The bots of a botnet can include computers, smartphones, virtualized machines, and/or a wide range of Internet of Things (IoT)devices such as IP cameras, smart TVs, routers, anything that has internet connectivity and can be compromised. In particular, IoT vulnerabilities and misconfigurations are extremely common in the consumer market making it very easy for hackers to create an IoT botnet. Moreover, botnets, particularly when they become part of an IoT botnet, can be enormous; a single botnet can be comprised of hundreds of thousands or even millions of hijacked devices.
Hijacking devices for a botnet involves finding devices that have security vulnerabilities to make it possible to be infected with “botware,” malware to be installed on the device. But the devicesinfected with botwarearen’t the only thing a botnet needs.
Many sources — including as of writing Wikipedia — appear to be confused about what constitutes a botnet. While the most obvious part of a botnet is the collection of devices it includes, the defining component is the existence of a Command and Control (C&C) system that controls what the network of bots does.
The botware on each compromised device communicates with the botnet C&C system and becomes part of a network of bots. Driven by commands from a “botmaster” or “botherder” — the person or group controlling the bots — some or all of the devices in the botnet do whatever they are asked to do.
Botnet Command and Control
The early communications between botnet command and control systems and botware on compromised devices were based on the client-server model using, for example, Internet Relay Chat (IRC). The botware connected to an IRC channel and waited for commands. Each bot can also respond on the same channel with status updates or remotely acquired data. Alternatives to IRC include the use of Telnet connections and HTTP requests for webpages or custom services. It’s worth noting that some botnets have used a hierarchical C&C system where layers of bots communicate in a client-server fashion with the bots in the layer above and relay commands to the layer below them.
The latest botnet command and control communications for botnets are based on peer-to-peer (P2P)connections. In this model, compromised devices discover each other by scanning IP address ranges to find specific port and protocol services and, when another botnet member is identified, sharing lists of known peers and relayed commands. This type of highly distributed mesh networking is obviously more complicated to create but also much harder to disrupt.
The Rise of the IoT Botnet
IoT devices include a huge range of commercial and consumer devices such as temperature measurement systems, smart TVs, IP cameras, smart door bells, security systems, network routers and switches, and even children’s toys. Despite a huge amount of commentary and warnings about IoT vulnerabilities and well-understood fixes to improve their security, basic defenses such as requiring effective passwords and not allowing default logins and user accounts are still ignored. Another source of IoT vulnerabilities comes from vendors not providing updates to address security problems and or the device owners failing to apply updates.
What Do Botnets Do?
Botnets are used for four main purposes and, generally, a botnet can be switched as a whole or in parts between any of these functions.
Spam and Phishing
One of the earliest uses of botnets was for generating spam, unsolicited commercial or fraudulent email. By using bots for this purpose, spammers avoid the problem of getting their bulk sending IP addresses blacklisted and even if some bots get blacklisted, there’ll always be more bots to use.
A more targeted use of botnet spam is for phishing for identity theft. By generating huge amounts of spam email messages inviting recipients to visit promotional websites, websites that appear to be banks or other financial institutions, enter competitions, etc., scammers try to harvest personal information such as bank account details, credit card data, and website logins.
Pay-per-Click Fraud
To increase website ad revenues — advertising networks such as Google pay-per-click on adverts the websites serve — botnets are used to fake user interaction. Because of the distributed nature of the sources of the clicks, it’s hard for the ad networks to identify click fraud.
Cryptomining
By running the algorithms that mine cryptocurrencies such as Bitcoin and Ether on tens of thousands of bots — an IoT botnet is the perfect platform. It thereby steals computer power from the device’s owner, and allows significant revenue without the usual costs of mining, mostly importantly, the cost of electricity.
DDoS Attacks as a Service
Distributed Denial of Service attacks are easily launched using botnets and, as with botnet generated spam, the distributed nature of the bots makes it difficult to filter out DDoS traffic. Botnets can execute any kind of DDoS attack and even launch multiple attack types simultaneously.
A relatively new hacker business is DDoS-as-a-Service. On the Dark Web and now, even on the regular web, you can buy DDoS attacks for as little as $5 per hour; the pricing depends on the required scale and duration of the attack.
A Very Brief History of Botnets
Arguably, the first true internet botnet was Bagle, first discovered in 2004. Bagle was a Windows worm that relayed spam sent from a botmaster. While the first version, called Bagle.A , was of limited success, the second version, Bagle.B infected something like 230,000 computers. On New Year’s Day 2010, the malware was responsible for roughly 14 percent of all spam. By April 2010, Bagle was sending approximately 5.7 billion spam messages per day. As with most malware, other hackers copied and improved the code with over 100 variants found in the wild by 2005.
Since then, arguably the first botnet to launch a DDoS attack was Akbot in 2007. The Akbot botnet was created by an 18-year-old in New Zealand. It used a C&C system based on IRC and at its peak involved 1.3 million computers.
Over time, botnet attacks have become commonplace and the biggest botnet known to date, the Russian BredoLab botnet,consisted of 30,000,000 devices..
The Future of Botnet and DDoS Attacks
Botnets are here to stay. Given the exponential growth of poorly secured IoT devices that can be co-opted into an IoT botnet as well as the growing population of vulnerable computers, botnet attacks have become endemic. As a cyber warfare tool, botnet and DDoS attacks have been observed on both sides of the Russian operation against Ukraine.
Whether you’re a government organization or a private company, you should be planning how you’re going to deal with a botnet and DDoS attack. Your first step is to realize that no online property or service is too big or too small to be attacked.
Second, plan for increased bandwidth ideally on an as needed basis. The ability to scale up your internet connection will make it harder for a botnet and DDoS attack to saturate your access and cut you off from the internet. The same elastic provisioning strategy applies to using cloud services rather relying than on-prem or single data center services.
Next, consider using or expanding your use of a content delivery network to increase your client-side delivery bandwidth. Using multiple CDNs also increases your resistance to DDoS attacks.
Finally, harden everything. Strategically deploying hardware and software DDoS mitigation services throughout your infrastructure is key to making botnet and DDoS attacks have minimal impact.
A10 Networks offers cyber security solutions that use advanced DDoS protection and mitigation strategies and protect against botnets and DDoS attacks. Options for the implementation of solutions can be very diverse: Proactive Deployment, Reactive Deployment, Reactive Deployment with Third-Party Flow Detector, Out-of-Band (TAP) Mode and others. A10 also provides full visibility into network traffic, making it harder for malware to infiltrate your networks or steal data without you knowing.
iIT Distribution is the official distributor of A10 Networks. We not only supply software and technical equipment, but also provide a full range of project support services. The initial examination and evaluation is carried out by highly qualified specialists, whose level is confirmed by the vendors' certificates.
Back
Facebook
LinkedIn
YouTube